v2: add content digest module and verify blob integrity on download #105
Conversation
steveej
force-pushed
the
pr/verify-layer-digests
branch
from
c36a9d9
to
2702636
Compare
|
@lucab All your comments are addressed, PTAL. Also, do you think mock tests would make sense for |
steveej
force-pushed
the
pr/verify-layer-digests
branch
2 times, most recently
from
a6cfb77
to
e33db41
Compare
|
@steveej I'm fine with either a mock-test or making sure travis runs a get_blob+verify against a live registry (I didn't check, I hope it does already). If you care about ensuring we catch the negative case (received blob with non-matching digest), then I think a mock-test is the only way. Except for tests, are there any other WIP parts in here? |
I'll give mocking this a try, shouldn't be too complex.
Except for the test and forming a proper git history I consider it complete. |
steveej
force-pushed
the
pr/verify-layer-digests
branch
from
e33db41
to
d710c65
Compare
steveej
force-pushed
the
pr/verify-layer-digests
branch
from
d710c65
to
7ac2c69
Compare
|
@lucab I added the most tests for |
src/v2/content_digest.rs
Outdated
|
|
||
| /// DigestAlgorithm declares the supported algorithms | ||
| #[derive(Display, Clone, Debug, PartialEq, EnumString)] | ||
| pub enum DigestAlgorithm { |
There was a problem hiding this comment.
This is not exposed in the library API, I think you can remove the pub (or scope it down to pub(crate)).
steveej
changed the title
This module implements content digest verification and will be used by the blob and manifest modules.
Use the content_digest module for consistency checks when downloading blobs. Also verify the format of the given digest.
|
#104 landed in the meanwhile. |
steveej
force-pushed
the
pr/verify-layer-digests
branch
from
7ac2c69
to
a91af0b
Compare
I'm pretty sure the commit was already in this history, but I rebased again and now the merge commit is in here too. I can see a lot of conversations which aren't marked as resolved. I think they're all settled though, please take a look if I missed anything. |
Motivation for this is to detect if a registry sends a blob which doesn't match its layer digest.
TODO
Depends on #104.